Device association adds a pre-enrollment tenant link to Windows Autopilot device preparation. It is useful when devices enrolled by the same person need different device-targeted preparation policies. It does not mean classic Autopilot was always driven by whoever signed in first.
What changes with association
Microsoft documents a TPM-backed association stored as a tenant-affinity marker in UEFI firmware. The association supports device-targeted preparation policy and corporate ownership before enrollment. Resetting Windows does not by itself remove that firmware association. See the device association overview.
OOBE customizations depend on the configuration and connection. For example, Microsoft notes that language and keyboard selection screens are not hidden when OOBE uses Wi-Fi. Test the setup experience on the same network conditions your users will have.
Check the specific requirements
The documented device-association requirement is a physical Windows 11 24H2 or 25H2 device with KB5120998 or later and a healthy TPM 2.0. Virtual machines are unsupported. Do not reuse the older baseline requirements for device preparation generally. Check Microsoft’s current software, network, licensing and role requirements before choosing the pilot devices.
Compare deployment modes without the false choice
Classic Autopilot profiles can be assigned to devices and include different deployment modes, including self-deploying scenarios. Association is a capability of device preparation; it does not automatically make that path the right answer for a kiosk, hybrid-joined fleet or every shared device. Compare the actual modes in Microsoft’s Autopilot profile guidance and the deployment comparison.
| Pilot decision | Evidence to collect |
|---|---|
| Correct policy | Expected policy and app assignments on each test device |
| Provisioning | OOBE behavior, enrollment and device ownership |
| Applications | Install, detection and required restart behavior |
| Security | Encryption, key escrow and agreed compliance checks |
| Reuse and exit | Reset behavior and supported removal of tenant association |
Include decommissioning in the plan
Microsoft’s current overview states that removing association from Intune is not supported; the association information must be cleared on the device using the documented removal process. Record that step for devices that permanently leave the organization. A lifecycle runbook should cover both arrival and exit.
Start with a small physical pilot. Capture the original registration state, chosen deployment policy, expected results and a rollback or reset path. Expand only after the named owner accepts the checks. The Intune and Autopilot deployment offer defines the device, platform and application scope before rollout.
Company laptops set up the same way, managed from one place.
A successful Intune deployment needs an agreed device model, application scope, pilot acceptance and a handover the administrator can use.